Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-001

agent was the target · researcher disclosure · unreviewed

ForcedLeak: a poisoned Web-to-Lead form turns Salesforce Agentforce into a data-exfiltration channel

Researchers showed that instructions placed in a public Web-to-Lead form field are later read by an Agentforce agent processing the lead, which queries CRM lead records and sends them to an attacker-controlled domain that was still on Salesforce's content allowlist because it had expired and been re-registered. CVSS 9.4. Salesforce enforced Trusted URL allowlists for Agentforce and Einstein AI and re-secured the domain.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-09-25 Noma Security discloses ForcedLeak; Salesforce has patched (Trusted URL allowlists) and re-secured the expired allowlisted domain · The Hacker News T2

What defenders can take from it

  1. Any field an agent will later read is an injection surface — treat untrusted CRM/form content as hostile input, not data.
  2. An allowlist of 'trusted' egress domains fails when one lapses and is re-registered; verify ownership, not just the string.
  3. Keep a human approval gate between an agent and any outbound send during a pilot.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 1

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.